@timestamp field is missing in dead letter queue

Elastic Stack Logstash
1

Hello everyone,

  1. I am using dead letter queue and based on some filters I want to index all the processed events to ES.
  2. In output section of dlq I am using, index => "index-prod-l%{+YYYYMMdd}" to create dynamic indices based on date and time.
  3. but when I ran this I got error => [FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::Error: timestamp field is missing>, :backtrace=>["org/logstash/ext/JrubyEventExtLibrary.java:177:in `sprintf'", ... and hence logstash got terminated.
  4. At the same time same index-name logic works with main pipeline and creates new indices on ES on daily basis.
  5. and when I change index name logic as index => "index-1" in dlq conf, the index got created on ES and processed events also got indexed on ES.
  6. so is there a way to check if @timestamp is present or not and if not is there a way to add it in the event?
  7. logstash version => 6.5.4, elasticsearch version => 6.6.0. and kibana version => 6.6.1
    Thanks in advance!
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.